12a1b9b804
PR-URL: https://github.com/nodejs/node/pull/19201 Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
28 lines
875 B
JavaScript
28 lines
875 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Tests that creating an iterator that shrinks the array populated by
|
|
// Array.from does not lead to out of bounds writes.
|
|
let oobArray = [];
|
|
let maxSize = 1028 * 8;
|
|
Array.from.call(function() { return oobArray }, {[Symbol.iterator] : _ => (
|
|
{
|
|
counter : 0,
|
|
next() {
|
|
let result = this.counter++;
|
|
if (this.counter > maxSize) {
|
|
oobArray.length = 0;
|
|
return {done: true};
|
|
} else {
|
|
return {value: result, done: false};
|
|
}
|
|
}
|
|
}
|
|
) });
|
|
assertEquals(oobArray.length, maxSize);
|
|
|
|
// iterator reset the length to 0 just before returning done, so this will crash
|
|
// if the backing store was not resized correctly.
|
|
oobArray[oobArray.length - 1] = 0x41414141;
|